1. Field
The present invention generally relates to systems and methods for securing wireless communications. More specifically, one feature of the invention provides a novel authentication and key agreement scheme for devices supporting legacy network authentication mechanisms, in order to provide application security keys by taking advantage of legacy wireless authentication and key agreement mechanisms.
2. Background
One type of cellular technology for wireless communications is defined by the Global System for Mobile (GSM) protocol, which operates on second generation (2G) wireless telephony networks. GSM is further extended by newer networks, such as General Packet Radio Service (GPRS), also known as 2.5G networks, which offers Internet content and packet-based data services for GSM networks. GSM and GPRS are used for many types of wireless communications including voice, Internet browsing, e-mail and multimedia data. GSM incorporates various security mechanisms to protect the content communicated over such systems. Service providers and users alike rely on these security mechanisms for the privacy of their communications and protection of their data, and service providers use these security measures to authenticate their subscribers for the purposes of billing. These security mechanisms typically operate by authenticating user mobile terminals to the network, and subsequent transmissions may be encrypted. However, GSM security measures are vulnerable to attack by third parties, owing to weaknesses in GSM security protocols, such as false base station attacks arising from a lack of network authentication, the possibility of replay of the security protocols, and weaknesses in GSM encryption algorithms.
These security weaknesses were addressed in the development of security protocols in third generation (3G) wireless communication standards. In particular the Authentication and Key Agreement (AKA) protocol developed for Universal Mobile Telecommunication System (UMTS) includes such features as a sequence number and Message Authentication Code (MAC) which prevent the false base station attacks to which GSM is susceptible. Thus mobile subscribers using a UMTS User Service Identity Module (USIM) for network authentication are not vulnerable to the attacks posed against users of a GSM Subscriber Identity Module (SIM).
3G standardization bodies are also developing a Generic Authentication Architecture (GAA), for example, in the third generation partnership project document 3GPP 33.220 Generic Authentication Architecture (GAA), for a generic bootstrapping architecture. This architecture relies on the 3G AKA protocol to establish keys between a mobile subscriber's User Equipment (UE) and a new server entity known as a Bootstrapping Server Function (BSF). From these keys further keys may be derived and provided by the BSF to various Network Application Functions (NAF), as a way of establishing security keys shared between the NAF and appropriate UE.
The techniques under development rely on the 3G authentication and key agreement methods, such as those supported in a UMTS Universal Subscriber Identity Module (USIM), with its inherent security improvements compared to 2G or earlier legacy systems such as GSM. For instance, Generic Authentication Architecture (GAA) and the Generic Bootstrapping Architecture (GBA) are specified for 3G networks and build on the security infrastructure of 3G mobile networks (i.e., USIM-based security) to provide secure mutual authentication between mobile user equipment and a network server that facilitates network applications and/or services.
However, these mutual authentication techniques (e.g., GAA and GBA) are not available to earlier-developed (e.g., 2G) communication systems, such as GSM Authentication and Key Agreement (AKA) protocols, for instance. These GSM protocols are susceptible to replay attacks, so an attacker may force re-use of keys, and possibly exploit weaknesses in some contexts to reveal the keys and thus undermine the security. Thus, a method is needed for bootstrapping application security keys from GSM authentication and key agreement in such a manner that is not susceptible to replay attacks and keys may not easily be revealed.
Thus, there is a need to establish techniques by which the Generic Authentication Architecture (GAA), specified for 3G networks, may be extended to support legacy systems (e.g., 2G or earlier systems). This would permit subscribers with GSM or other devices, having Subscriber Identity Modules (SIM), to be provisioned with keys for use in mobile network applications and/or services without necessitating replacement of their SIMS by a UMTS USIM. Moreover, such method should not introduce weaknesses to the Generic Authentication Architecture owing to the vulnerabilities of the GSM authentication itself.